You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
25 lines
901 B
25 lines
901 B
8 months ago
|
import hashlib
|
||
|
|
import sys
|
||
|
|
import splunk.Intersplunk as si
|
||
|
|
|
||
|
|
if __name__ == '__main__':
|
||
|
|
try:
|
||
|
|
keywords,options = si.getKeywordsAndOptions()
|
||
|
|
if len(keywords) == 0:
|
||
|
|
si.generateErrorResults('Requires fields list.')
|
||
|
|
exit(0)
|
||
|
|
search = ' '.join(keywords)
|
||
|
|
results,dummyresults,settings = si.getOrganizedResults()
|
||
|
|
|
||
|
|
for result in results:
|
||
|
|
eventSignature = '-=XXX=-'.join([result.get(field,'') for field in keywords])
|
||
|
|
if sys.version_info >= (3, 0):
|
||
|
|
eventSignature = eventSignature.encode('utf-8')
|
||
|
|
sigHash = hashlib.sha1(eventSignature).hexdigest()
|
||
|
|
result['_icon'] = sigHash
|
||
|
|
si.outputResults(results)
|
||
|
|
except Exception as e:
|
||
|
|
import traceback
|
||
|
|
stack = traceback.format_exc()
|
||
|
|
si.generateErrorResults("Error '%s'. %s" % (e, stack))
|